Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2021-26295 PoC — RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

Source
https://github.com/S0por/CVE-2021-26295-Apache-OFBiz-EXP
Associated Vulnerability
Title:RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI (CVE-2021-26295)
Description:Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
Description
Apache OFBiz rmi反序列化EXP(CVE-2021-26295)
Readme
# Apache OFBiz rmi反序列化EXP(CVE-2021-26295)

目前仅支持nc弹shell


将ysoserial.jar放置在同目录下，py3运行，根据提示输入漏洞url，你的vps地址和端口

第二次使用建议删除exp.ot

本工具仅用于安全测试，禁止未授权非法攻击站点，否则后果自负。
File Snapshot

 [4.0K]  /data/pocs/46ee7390af2f4959e9046f0dccfcfbd1d2407a38
├── [1.8K]  CVE-2021-26295-Apache-OFBiz-EXP.py
└── [ 314]  README.md

0 directories, 2 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →